The AI Brief
Today's brief:
- DeepSeek closes a $15 billion round backed by Tencent and CATL, one of the largest AI financings China has ever produced, signaling the Hangzhou lab is done operating lean.
- Meta raises its 2026 AI infrastructure floor to $135 billion after a Q3 revenue beat, and creates a non-voting Class C share to fund the buildout without diluting Mark Zuckerberg's control.
- AI-discovered critical PHP flaws forced emergency patches and website shutdowns worldwide, demonstrating that agent-led vulnerability research now moves faster than coordinated disclosure can follow.
- OpenAI brings GPT-6 Astra, Sol, and Luna to Google Cloud Model Garden, making Google the only hyperscaler selling all three closed-source frontier model families side by side.
- Multiple Google DeepMind researchers resign over the lab's Pentagon and Israel military contracts, the first organized talent departure over AI weaponization since Project Maven in 2018.
- Also today: Anthropic is expected to publicly file its S-1 prospectus as early as Friday, clearing the last procedural barrier to a November listing; some investors have trimmed their valuation target from $2 trillion to around $1.5 trillion (first covered Vol. I, No. 148).
DeepSeek closes $15 billion round, doubling its fundraising target
DeepSeek, the Hangzhou-based AI lab led by founder Liang Wenfeng, has raised approximately 100 billion yuan (roughly $15 billion) in its latest funding round, Bloomberg and Reuters reported on October 21. Battery maker Contemporary Amperex Technology (CATL) and internet conglomerate Tencent Holdings were among the largest investors, according to people familiar with the matter. The round's financial details have not been publicly disclosed by the company.
DeepSeek raised its target at least twice during negotiations, beginning at 50 billion yuan, then 80 billion yuan, before settling at 100 billion yuan, a sign of investor demand that exceeded initial expectations. The financing ranks among China's largest-ever AI fundraising rounds. It follows a May 2026 Series A at $7 billion and a post-money valuation of $52 billion. The round is expected to close in the coming days, though terms could still change.
DeepSeek plans to direct proceeds toward data center expansion and open-source AI development. The company's annualized revenue run rate crossed $1 billion in September, after CEO Liang raised API prices 2.3 to 4.5 times without losing customers. Bloomberg also reported that DeepSeek hired CITIC Securities in September to prepare for a potential STAR Market IPO. The new capital substantially narrows the resource gap with OpenAI and Anthropic, each of which has now raised over $100 billion, though US chip export controls continue to limit DeepSeek's access to Nvidia's most advanced accelerators.
Meta lifts its AI spend floor and creates a new share class to fund it without ceding control
Meta reported third-quarter 2026 revenue of $64.6 billion, up 26% year over year and ahead of consensus estimates of roughly $63.4 billion. The company raised the floor of its full-year 2026 capital expenditure guidance to $135 billion from $130 billion, leaving the $145 billion ceiling unchanged. This is the fourth capex increase in 2026; Meta entered the year guiding to $115 to $135 billion. The money is going primarily toward AI infrastructure, specifically data centers, custom silicon, and energy deals supporting Muse, its consumer AI agent, and its frontier model training programs.
Alongside the earnings, Meta announced a 2-for-1 stock split under which every existing Class A shareholder receives one new non-voting Class C share. The structure lets Meta raise equity capital for the AI buildout without weakening Zuckerberg's voting control. Wall Street consensus for Meta's 2027 capex now sits around $196 billion, suggesting the investment cycle is still accelerating. Meta's Q3 per-share earnings of $3.83 beat expectations by a wide margin. The company guided Q4 revenue above consensus.
AI finds 14-year-old PHP flaw that forced emergency patches across the internet
Unauthenticated RCE (remote code execution) = an attacker can run arbitrary code on a target server without needing a password or account. On a web server, that means full control of the machine and everything it can reach on the internal network.
PHP shipped four security releases on October 21, 2026, fixing two critical flaws: CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0. Researchers at security firm Calif, working under OpenAI's Patch the Planet program, discovered one flaw on August 1 using GPT-5.6 Sol. Wiz independently discovered and reported both vulnerabilities. The disclosed flaw in CVE-2026-109618 had been present in PHP for approximately 14 years; a limited version was found in 2024 and judged insignificant at the time. CVE-2026-109619 involves a use-after-free condition in PHP's worker process request handling.
Researchers demonstrated pre-authentication remote code execution against WordPress, Drupal, and Joomla, and separately demonstrated Heartbleed-style memory disclosure against any PHP application. Cloudflare began deploying web application firewall protections in early October. CERT-EU says PHP maintainers pre-announced the security release on October 20, with patches shipping at 13:30 UTC on October 21. The PHP Foundation's own advisory reads: "All PHP users are strongly encouraged to update immediately."
OpenAI framed the disclosure as the first major output of Patch the Planet, a coordinated-disclosure program launched June 22, 2026, and committed $1 billion in subsidized access to its Daybreak cyber models for resource-constrained organizations. OpenAI also announced an international vulnerability-response framework on October 21, proposing to extend the PHP coordination model to future AI-discovered flaws. The episode represents the first time an AI-assisted program publicly claimed credit for discovering a critical vulnerability in a runtime-level open-source project, as distinct from application-layer bugs.
OpenAI lands on Google Cloud, completing all three major hyperscalers
OpenAI and Google Cloud announced on October 21, 2026 that GPT-6 Astra, GPT-6.1 Sol, and GPT-6 Luna, plus OpenAI's Codex agentic coding workflows, are entering private preview in Google Cloud's Model Garden. General availability is planned in the coming weeks. Purchases will be routed through Google Cloud Marketplace and count against customers' existing cloud spending commitments. OpenAI's announcement stated explicitly that "Microsoft remains OpenAI's primary cloud partner," with Microsoft's exclusive license having expired in April 2026. Oracle customers received access in June 2026.
The deal also extends to Google's Antigravity AI development environment and the Gemini Agent orchestration layer. Google Cloud frames the arrangement as proof of its model-neutral ambitions: the catalog already includes more than 200 first-party, third-party, and open-weight models. For OpenAI, the Google Cloud channel adds distribution reach among enterprise buyers who have resisted re-platforming to Azure or the OpenAI API. The partnership mirrors an earlier OpenAI expansion onto Amazon Web Services earlier in 2026. Neither company published Google-side prices; OpenAI's own API lists Sol at $2.00 per million input tokens.
Google DeepMind researchers resign over Pentagon and Israel military AI contracts
Research engineer Sofia Liguori resigned from Google DeepMind this week after three years at the company, citing the lab's growing involvement with US and Israeli defense forces. Liguori joined in 2023 to work on AI for power grid optimization. After Google announced a classified military AI contract with the Pentagon in April 2026, she staged a personal sick-out using leave time, and ultimately resigned. In an internal letter, she urged colleagues to "stay human." Andreas Kirsch, an AI researcher, had separately resigned from DeepMind earlier in October over the same concerns. The BBC spoke with several current and former employees on the record, per its October 21 report.
Kirsch told the BBC that Google's governance and oversight are "not sufficient or meaningful enough to deploy AI safely and responsibly in military and classified settings." The departing researchers expressed concern specifically about Google's Project Nimbus contract, a joint arrangement with Amazon that furnishes Israel's military and top weapons manufacturers with advanced AI tools. They cited this year's expanded Pentagon deal as materially increasing the scope of military AI use, beyond what earlier contracts permitted. Google said publicly that its defense contracts go through reviews for compliance with its AI principles and acceptable-use policies.
The resignations echo the 2018 Project Maven episode, when roughly a dozen Google employees quit after the company won a Pentagon contract to analyze drone footage using AI, ultimately prompting Google to decline renewal. In 2026, the contracts in question are substantially broader in scope and more deeply integrated into DeepMind's core research capacity. No equivalent public departures over military AI have yet been reported at OpenAI, Anthropic, or Meta, though all four labs now hold some form of US defense relationship.